Privacy Policy

Privacy Notice for candidates and individuals wishing to register an interest in working for us

About us

We’re sending you this privacy notice as you have applied, or are considering applying, for a position within HCRG Care Group. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

We thought it would be helpful for you to understand a little bit about our organisation and how we look after your information when you submit it. The job advert should generally provide you with the recruiting process but this will also form part of your contractual documentation.

“HCRG Care Group” refers to each of the various entities that make up HCRG Care Group as a group. This includes HCRG Care Group Limited and its subsidiaries (as defined in section 1159 of the Companies Act 2006), as well as VH Doctors Ltd, HCRG Care Group Practices Limited, the Randolph Partnership, Peninsula Health LLP and Assura Reading LLP.

This notice is broken down into the following sections:

When you apply for a job with us

What types of personal data we collect about you?

How we use your personal data

Legal basis

Sharing your personal information

How we store and protect your data

Data retention

Your rights and who to contact

When you apply for a job with us

HCRG Care Group Limited is a “data controller” for corporate job applications. This means that we are responsible for deciding how we hold and use personal information about you. You are being sent a copy of this privacy notice because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for.

HCRG Care Group is also contracted to act as a processor on behalf of the other legal entities within HCRG Care Group and is responsible for managing the recruitment process on the behalf of the other data controllers.

HCRG Care Group has a team of in-house recruiters who look after all of our health and care and corporate recruitment. Occasionally we do need external help with a role and at that point we will partner with trusted agencies with whom we have an existing relationship and who understand our culture and ethos. Applications are generally received through our website or via NHS Jobs through our supporting third party hosted recruitment system “Tribepad”.

Having received your application for a position, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role.

  • If you do, we will decide whether your application is strong enough to invite you for an interview.
  • If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role.
  • If we decide to offer you the role, we will then take up references and, where required, carry out a Disclosure and Barring Service (DBS) check and occupational health screening before confirming your appointment.

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications, work history and right to work documentation), we will not be able to process your application successfully. For example, if we require references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

What types of personal information we collect about you?

We will collect, store and use the following categories of personal information about you in connection with your application for work:

  • The information you have provided to us in your on-line application and/or curriculum vitae and any supporting covering letter including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications; 
  • Right to work documentation;
  • Any information you provide to us during an interview, interview notes and any supporting test results;
  • References from former employees or contacts.

We may also collect, store and use the following “special categories” of more sensitive personal information:

  • Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions;
  • Information about your health, including any medical condition, health and sickness records; 
  • Information about criminal convictions and offences.

How we use your personal data

We will use the personal information we collect about you to:

  • Assess your skills, qualifications, and suitability for the role that you have applied for;
  • Carry out background and reference checks, where applicable;
  • Communicate with you about the recruitment process; 
  • Keep records related to our hiring processes;
  • Comply with legal or regulatory requirements.

We will use your particularly sensitive personal information in the following ways:

  • We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview or in preparation for you starting to work with us if your appointment is confirmed.
  • We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or yoursexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

Information about criminal convictions

  • We may collect information about your criminal convictions history if we would like to offer you the role (conditional on checks and any other conditions, such as references, being satisfactory).
  • For some roles we are required to carry out DBS checks in order to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role.
  • We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

Legal basis for processing your personal data

  • It is in our legitimate interests to decide whether to appoint you to work within the organisation since it would be beneficial to our business to appoint someone to that role;
  • We need to process your personal information to decide whether to enter into a contract of employment with you.

Sharing your personal information with third parties

The recruitment team will only share relevant personal information with trusted third parties for the purposes of processing your application: 

  • Our occupational health provider as part of successful candidate screening
  • Disclosure and Barring Service (DBS) HMRC
  • Referees
  • HCRG Care Group teams who provide support services such as payroll, finance, legal, IT Support, claims, insurance, incident and risk management, health and safety and information governance.

How we store and protect your data

The confidentiality and security of your information is of paramount importance to us. We take the utmost care when handling your personal and confidential information and ensure that we have appropriate organisational and technical security measures in place to prevent unauthorised access, accidental damage, destruction or loss. Access to your information is on a need to know basis.

We use computer safeguards such as firewalls and data encryption and enforce physical access controls to our buildings and records to keep information safe and expect those who are employed or who work in partnership with us have regular training and follow our policies and procedures.

Where we use third party IT providers to host information, we will only do so under contract and after we have obtained assurances of compliance with data protection laws.

Data retention

We will keep your information for no longer than is necessary. This organisation retains records in accordance with the Records Management Code of Practice for Health and Social Care 2016.

For individuals registering an interest in working for us we apply a 12-month retention period to the data you have submitted and will contact you via email on a yearly basis giving you the option to remain in our talent pool and update any details with us. If you did not opt in to receiving future emails when registering your interest with us your data will be deleted in 12 months. Alternatively, you can ask for this data to be deleted at any time by contacting the Data Protection Officer (details below).

Your rights and who to contact

Data Protection laws provide you with the following rights:

The right to be informed You have a right to be informed about the collection and use of your personal data (as per this privacy notice).
The right of access You are entitled to request a copy of the personal data we hold about you. We will respond to this within a month
The right to rectification You are entitled to request changes to information if it is inaccurate or incomplete. We will respond to these requests within a month.
The right to erasure Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data. We will respond to these requests within a month.
The right to restrict processing Under certain circumstances, you may be entitled to restrict or suppress the use of your personal data. We will still hold the data, but will not process it any further. We will respond to these requests within a month.
The right to data portability Subject to certain conditions , you may request a copy of your personal data to be transferred to another organisation.
The right to object to processing You have the right to object to the processing of your personal data in certain circumstances. For example, you have an absolute right to stop your data being used for direct marketing
Rights in relation to automated decision making and profiling We do not carry out any automatic decision making/profiling

Please note that the above rights may not apply in all circumstances. If you have any questions or concerns about the information we hold on you, please contact our Data Protection Officer by one of the following options:

Via our secure Data Subject Rights Portal


Tel: 01928 242942


FAO Head of Information Governance & Data Protection Officer

HCRG Care Group

The Heath Business and Technical Park




If you are not happy about the way your information is handled, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioners Office (ICO).

Changes to our privacy notice

We will update this privacy notice from time to time to reflect any changes to our ways of working. Please contact our Data Protection Officer if you would like more information.

Last update: January 2020